Obfuscated Tor Traffic Identification Based on Sliding Window

Table 1

Analysis of nonobfuscated Tor traffic identification techniques.

Reference	Feature selection	Type of algorithm/method	Dataset	Evaluation metrics
Lashkari et al. [10]	Time-related features	Random Forest; C4.5; KNN	Self-collected, called Tor-nonTor (ISCXTor2016)	Precision; recall
Hodo et al. [11]	Time-related features using correlation-based feature selection	Artificial neural network; support vector machine	The same as [8]	Accuracy; precision; false positive rate
Almubayed et al. [12]	Features generated by NetMate (http://f00l.de/netmate/)	Naïve Bayes; C4.5; Random Forest; support vector machine	Self-collected	Precision; FP rate
Mayank and Singh [13]	Statistics calculated by NetAI (http://caia.swin.edu.au/urp/dstc/netai)	Random Forest; J4.8; AdaBoost	Self-collected	TP rate; FP rate; ROC Area
Cuzzocrea et al. [14]	Features calculated by ISCXFlowMeter (the tools implemented by [8])	J4.8; BayesNet; jRip; OneR; RepTREE	Self-collected	TP rate; FP rate; precision; recall; F-measure; MCC; ROC Area; PRC area
Rao et al. [16]	Packet level and flow level features	Gravitational clustering	Self-collected	Rand statistic; Jaccard coefficient; FM; averaged accuracy
He et al. [16]	TLS/SSL-related features; packet size-related features	TLS fingerprint-based method; packet size distribution-based method	CAIDA Equinix Chicago (http://www.caida.org/data/passive/passive_2010_dataset.xml)	TP rate; false positive rate
Barker et al. [17]	TLS/SSL-related features	Just logical judgment	Self-collected	-
Bai et al. [18]	Traffic fingerprints; characteristic strings	AC-BM algorithm	Self-collected	Recognition rate; misrecognition rate
Zhioua [19]	Interpacket times	Hidden Markov models	Self-collected	Precision; F-measure